Canadian Imperial Bank of Commerce CM-T will pay a $3-million penalty after the financial institution watchdog for consumers said that the lender failed to transfer some credit card transactions to new cards in a timely manner, resulting in additional fees for customers.
In a May decision published Thursday, the Financial Consumer Agency of Canada (FCAC) said that over the course of 18 years, CIBC violated a rule that requires banks to provide customers with accurate information on credit card statements. The announcement comes days after the Globe and Mail reported that CIBC is under remediation orders from Canada’s banking regulator after an audit of its mortgage portfolio revealed breaches of rules that limit levels of debt for borrowers.
The FCAC alleges that from May 2003 to June 2021 CIBC failed to properly transfer transactions after a credit card was deactivated because it was lost, stolen or defrauded. Due to the delay, the new account statements did not reflect all outstanding transactions. As a result, the account balances, amount due, available credit limit and the payment date were incorrect – and some customers were charged interest, over-limit fees and other costs.
On Thursday, the FCAC also revealed that National Bank of Canada had paid a penalty of $600,000 in April related to violations that occurred between 2001 and 2018. The lender failed to properly process interest payments, which affected more than 920,000 personal loans, representing a financial impact of more than $772,000.
CIBC found that more than 125,000 accounts were affected by its errors, and that $1.5-million in improper fees, interest and premiums were charged to those accounts. The bank’s standard processing period is five days, but $51.7-million in credit transactions were not transferred within that time frame. Some customers experienced delays as long as three years.
“This violation deprived customers of accurate reporting on their credit card statements and persisted for many years, causing harm,” the FCAC said in its decision.
CIBC self-identified and reported the issue to the FCAC in September 2020, and brought on a third-party company to help identify affected customers. It attributed the issue with lost or stolen cards to employee error and an ineffective quality assurance program. For the defrauded cards, the bank said that the error was caused after a specialized fraud claims team was eliminated in April 2018 and replaced by an automated process that failed to transfer credit transactions.
“This matter affected a very small percentage of credit card clients whom we have already refunded with interest after self-identifying and self-correcting the issue,” CIBC spokesperson Tom Wallis said in an e-mail statement. “Our team is focused on doing what’s right for our clients and when we identify an issue, we work to advise our clients and take steps to correct it right away, as we did in this case.”
To fix the issue, CIBC implemented new procedures in July 2020 that corrected the process for defrauded cards. It also reintroduced a dedicated team to monitor the processing of credit transactions and established a quality assurance program for defrauded accounts.
In June 2021, the bank introduced new processes for lost or stolen cards with a quality assurance program to ensure that employees follow procedures.
By September 2021, CIBC had transferred all outstanding transactions and refunded the charges, along with 3 per cent interest. The average amount of the charges was $122.31 for defrauded cards and $96.85 for lost or stolen cards. It also made a charitable donation for customers who could not be located or whose refund was less than $5.
The FCAC said that it did not find any evidence to suggest that CIBC intentionally breached its regulatory obligations, but that its “controls were inadequate and ineffective,” demonstrating “significant negligence.”
According to the FCAC’s decision document, CIBC said that the organization overemphasized the 18-year duration of the issue, stating that the lengthy period indicates that there were infrequent errors, representing less than 1 per cent of all lost or stolen cards.
On the issue of the defrauded cards, CIBC said that the shorter duration of the breach – which spanned two years – should result in a lower assessment of negligence.
The FCAC initially proposed a penalty of $3.25-million. CIBC admitted to the violation, but disputed the watchdog’s assessment of the level of harm involved, prompting the FCAC to lower the penalty.